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We investigate limitations imposed by sequential attacks on the performance of differential-phase- 
shift quantum key distribution protocols that use pulsed coherent light. In particular, we analyze two 
sequential attacks based on unambiguous state discrimination and minimum error discrimination, 
respectively, of the signal states emitted by the source. Sequential attacks represent a special type 
of intercept-resend attacks and, therefore, they do not allow the distribution of a secret key. 
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I. INTRODUCTION 

Quantum key distribution (QKD) is a technique 
that exploits quantum effects to establish a secure se- 
cret key between two parties (usually called Alice and 
Bob). This secret key is the essential ingredient of the 
one-time-pad or Vernam cipher 0, the only known en- 
cryption method that can provide information-theoretic 
secure communications. 

The first complete scheme for QKD is that introduced 
by Bennett and Brassard in 1984 (BB84 for short) 0. 
A full proof of the security for the whole protocol has 
been given in Ref. After the first demonstration of 
the feasibility of this scheme Q , several long-distance im- 
plementations have been realized in the last years (see, 
for instance, Ref. [|| and references therein). However, 
these practical approaches differ in many important as- 
pects from the original theoretical proposal, since that 
demands technologies that are beyond our present ex- 
perimental capability. Specially, the signals emitted by 
the source, instead of being single-photons, are usually 
weak coherent pulses (WCP) with typical average pho- 
ton numbers of 0.1 or higher. Moreover, the detectors 
employed by the receiver have a low detection efficiency 
and are noisy due to dark counts. These facts, together 
with the loss and the noise introduced by the quantum 
channel, jeopardize the security of the protocol, and leads 
to limitations of rate and distance that can be covered 
by these techniques 0, ■ 

The main security threat of QKD based on WCP arises 
from the fact that some pulses contain more than one 
photon prepared in the same polarization state. Now, 
an eavesdropper (Eve) can perform, for instance, the 
so-called Photon Number Splitting (PNS) attack on the 
multi-photon pulses 0. This attack provides Eve with 
full information about the part of the key generated from 
the multi-photon signals, without causing any distur- 
bance in the signal polarization. As a result, it turns out 



that the BB84 protocol with WCP can give a key gener- 
ation rate of order 0(j] 2 ), where r\ denotes the transmis- 
sion efficiency of only the quantum channel Q. 

To obtain higher secure key rates over longer distances, 
different QKD schemes robust against the PNS attack 
have been proposed in recent years. One of these schemes 
is the so-called decoy-states 0, where Alice ran- 
domly varies the mean photon number of the signal states 
sent to Bob by using different intensity settings. This 
technique delivers a key generation rate of order 0(rj) 
[l3>|n[. Other possibility is based on the transmission 
of two non-orthogonal coherent states together with a 
strong reference pulse [T^ ]. This scheme has been an- 
alyzed in Ref. |l3|. where it was confirmed that also in 
this scenario the secure key rate is of order 0(i]). Finally, 
another possible approach is the use of differential- phase- 
shift (DPS) QKD protocols H E3 • In this kind 
of schemes, Alice sends to Bob a train of WCP whose 
phases are randomly modulated by or tt. On the re- 
ceiving side, Bob measures out each incoming signal by 
means of an interferometer whose path-length difference 
is set equal to the time difference between two pulses. In 
this case, however, a secure key rate of order 0{rf) has 
only been proven so far against a particular type of in- 
dividual attacks where Eve acts on photons individually, 
rather than signals 15]. Whether DPS QKD is secure 
against the most general attack remains an important 
open question. 

In this paper, we investigate limitations imposed by 
sequential attacks on the performance of DPS QKD pro- 
tocols. In this kind of attacks, Eve measures out every 
coherent state emitted by Alice and prepares new sig- 
nal states, depending on the results obtained, that are 
given to Bob. Whenever Eve obtains a predetermined 
number of consecutive successful measurement outcomes, 
then she prepares a train of WCP that is forwarded to 
Bob. Otherwise, Eve sends vacuum signals to Bob to 
avoid errors. Sequential attacks constitute a special type 
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of intercept-resend attacks 0, 0, |2(j and, therefore, 
they do not allow the distribution of a secret key [2l| . 
Here we shall consider a conservative definition of se- 
curity, i.e., we assume that Eve can control some flaws 
in Alice's and Bob's devices (e.g., the detection efficiency 
and the dark count probability of the detectors), together 
with the losses in the channel, and she exploits them to 
obtain maximal information about the shared key. 

We analyze two possible sequential attacks. In the 
first one, Eve realizes unambiguous state discrimination 
(USD) of Alice's signal states [H |H |23|. When Eve 
identifies unambiguously a signal state sent by Alice, then 
she considers this result as successful. Otherwise, she 
considers it a failure. In the second attack, Eve per- 
forms first a filtering operation on each signal emitted by 
Alice and, afterwards, she measures out each successful 
filtered state following the approach of minimum error 
discrimination (MED) 0>l2£l]j she guesses the iden- 
tity of the filtered state with the minimum probability 
of making an error. (See also Ref. |2lJ.) As a result, we 
obtain upper bounds on the maximal distance achievable 
by DPS QKD schemes as a function of the error rate in 
the sifted key, the double click rate at Bob's side, and 
the mean photon-number of the signals sent by Alice. 

Instead of using an USD measurement on each signal 
state sent by Alice, like in the first sequential attack that 
we consider, Eve could as well employ the same detection 
device like Bob. This sequential attack was very briefly 
introduced in Ref. 15]. A successful result is now asso- 
ciated with obtaining a click in Eve's apparatus, while a 
failure corresponds to the absence of a click. However, 
since Alice's signal states are typically coherent pulses 
with small average photon number, the probability of 
obtaining a successful result in this scenario is always 
smaller than the one of a sequential USD attack. There- 
fore, a sequential USD attack can provide tighter upper 
bounds on the performance of DPS QKD protocols than 
those derived from an eavesdropping strategy where Eve 
uses the same measurement apparatus like Bob. 

A different QKD scheme, but also related to DPS QKD 
protocols, has been proposed recently in Ref. |27|. (See 
also Ref. H^.) However, since the abstract signal struc- 
ture of this protocol is different from the one of DPS 
QKD schemes, the analysis contained in this paper does 
not apply to that scenario. Sequential attacks against 
the QKD protocol introduced in Ref. (2?J have been in- 
vestigated in Ref. |29j following a similar approach like 
in this paper. 

The paper is organized as follows. In Sec. [H] we de- 
scribe in more detail DPS QKD protocols. Then, in 
Sec. IIIII we present sequential attacks against DPS QKD 
schemes. Sec. IIVI includes the analysis for a sequen- 
tial USD attack. Here we obtain an upper bound on 
the maximal distance achievable by DPS QKD schemes 
as a function of the error rate, the double click rate at 
Bob's side, and the mean photon-number of Alice's signal 
states. Similar results are derived in Sec.0 now for the 
case of sequential attacks based on MED of the signals 




FIG. 1: Basic setup of a DPS QKD scheme. PM denotes a 
phase modulator, BS, a 50 : 50 beam-splitter, M, a mirror, 
DO and Dl are two photon detectors, and At represents the 
time difference between two consecutive pulses. 



sent by Alice. Finally, Sec. IVII concludes the paper with 
a summary. 



II. DIFFERENTIAL-PHASE-SHIFT QKD 

The setup is illustrated in Fig. ffl [H [H G3 . Alice 
prepares first a train of coherent states \a) and, after- 
wards, she modulates, at random and independently ev- 
ery time, the phase of each pulse to be or tt. As a result, 
she produces a random train of signal states \a) or | — a) 
that are sent to Bob through the quantum channel. On 
the receiving side, Bob uses a 50 : 50 beam-splitter to di- 
vide the incoming pulses into two possible paths and then 
he recombines then again using another 50 : 50 beam- 
splitter. The time delay introduced by Bob's interferom- 
eter is set equal to the time difference At between two 
pulses. Whenever the relative phase between two con- 
secutive pulses is (±7r) only the photon detector DO 
(Dl) may produce a "click" (at least one photon is de- 
tected). For each detected event, Bob records the exact 
time where he obtained a click and the actual detector 
that fired. 

Once the quantum communication phase is completed, 
Bob uses a classical authenticated channel to announce 
the time instances where he detected at least one pho- 
ton. From this information, together with the knowledge 
of the phase value used to modulate each pulse, Alice 
can infer which photon detector fired at Bob's side each 
given time. Then, Alice and Bob can agree, for instance, 
to select a bit value "0" whenever the photon detector DO 
clicked, and a bit value "1" if the detector Dl fired. In 
an ideal scenario, Alice and Bob end up with an identical 
string of bits representing the sifted key. Due to the noise 
introduced by the quantum channel together with possi- 
ble imperfections of Alice's and Bob's devises, however, 
the sifted key typically contains some errors. Then, Alice 
and Bob perform error-correction to reconcile the data, 
and privacy amplification to decouple the data from Eve. 
(See, for instance, Ref. pj.) 

In the next section we analyze simple sequential at- 
tacks against the DPS QKD protocol introduced above 
that are particularly suited for the signal states and de- 
tection methods employed by Alice and Bob, together 
with the attenuation introduced by the channel. Let us 
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emphasize here that these attacks might not be optimal, 
but, as we will show below, they already impose strong 
restrictions on the performance of DPS QKD schemes 
with weak coherent pulses. 



III. SEQUENTIAL ATTACKS AGAINST 
DIFFERENTIAL-PHASE-SHIFT QKD 

A sequential attack can be seen as a special type of 
intercept-resend attack. First, Eve measures every co- 
herent state emitted by Alice with a detection apparatus 
located very close to the sender. Afterwards, she trans- 
mits each measurement result through a lossless classical 
channel to a source close to Bob. Whenever Eve obtains 
a predetermined number of consecutive successful mea- 
surement outcomes, this source prepares a train of new 
signal states that is forwarded to Bob. Otherwise, Eve 
sends vacuum signals to Bob to avoid errors. Whether 
a measurement is considered to be successful or not and 
which type of non-vacuum states Eve sends to Bob de- 
pends on Eve's particular eavesdropping strategy and on 
her measurement device. Sequential attacks transform 
the original quantum channel between Alice and Bob 
into an entanglement breaking channel |2fij and, there- 
fore, they do not allow the distribution of a secret key 

El' 

We begin by introducing Eve's measurement appara- 
tus. As mentioned previously, we shall consider two pos- 
sible alternatives. Each alternative provides a different 
sequential attack. In the first one, Eve realizes USD 
[221 |23| of Alice's signal states. Whenever Eve identi- 
fies unambiguously a signal state sent by Alice, i.e., she 
determines without error whether it is \a) or | — a), she 
considers this result as successful. If the measurement 
outcome corresponds to an inconclusive result then she 
considers it a failure. The second eavesdropping strategy 
can be decomposed into two steps: first, Eve performs 
a filtering operation on each signal state sent by Alice 
with the intention to make them, with some finite prob- 
ability, more "distinguishable" . A failure refers now to 
those signal states for which the filtering operation does 
not succeed. Afterwards, Eve measures out each success- 
ful filtered state following the approach of MED [24 1 125 ^ 
Her goal is to guess the identity of the filtered states with 
the minimum probability of making an error. Notice that 
the first eavesdropping strategy can be considered as a 
special case of the second eavesdropping strategy where 
the probability that Eve makes an error in distinguishing 
a state |a) and | — a) is exactly zero. We shall denote as 
Psucc the probability that Eve obtains a successful result 
whatever the measurement device she employs. 

In order to evaluate her measurement outcomes, we 
shall consider that Eve divides her data into different 
blocks of length M, where each block contains M con- 
secutive measurement results. Moreover, we assume that 
Eve analyzes each block of data independently, i.e., with- 
out considering the data included in other blocks. As we 
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FIG. 2: Illustration of a sequential attack. In this example 
the length of each block is M = 5, the minimum number 
of consecutive successful results within a block is given by 
Mmin = 3, and we assume that Eve obtains m = 4 consecu- 
tive successful results within a block. A successful outcome is 
represented with a vertical solid line in the classical channel, 
while a failure result is denoted with a vertical dashed line. 



will show later on, this eavesdropping strategy will nec- 
essarily create some error rate that decreases when incre- 
menting the block length M. In this scenario, we define 
the integer parameter M m j„, with [M/2+ lj < M m i n < 
M, as the minimum number of consecutive successful re- 
sults within a block that Eve needs to obtain in order to 
send Bob a new train of coherent states \ fie l0j ). This def- 
inition of M m i n arises from the particular eavesdropping 
strategies that we consider here, and the role of this pa- 
rameter M m i n will become clear later on. More precisely, 
if m denotes the total number of consecutive successful 
outcomes obtained by Eve within a block, then, when- 
ever m is bigger than M m i n , Eve prepares m consecutive 
coherent states \/3e i(>1 ), \/3e i92 ), \(3e i9m ), together with 
M — m vacuum states for those unsuccessful results within 
the block and sends these signals to Bob. On the other 
hand, if m < M m i n Eve sends to Bob M vacuum states. 
The case m — M min deserves a special attention. We 
shall consider that in this case Eve employs a probabilis- 
tic strategy that combines the two previous ones. In par- 
ticular, we assume that Eve sends to Bob M m i n consec- 
utive coherent states \/3e Wl ), \[3e l92 ),. . . , \/3e it>M ^ ) with 
probability q and, with probability I — q, she sends to 
Bob M vacuum states. That is, the parameter q allows 
Eve to smoothly fit her eavesdropping strategy to the 
observed data. 

The angle 6j of a coherent state \Pe lSj ) prepared by Eve 
depends on her particular measurement strategy. When 
she utilizes an USD measurement, then 9j = if the state 
identified by her measurement is |a), and 9j = tt if the 
state identified is | — a) . A similar criterion can also be 
applied to the case where Eve performs a filtering oper- 
ation followed by a MED measurement on the successful 
filtered states: If the result obtained is associated with 
the signal state |a) then 6j — 0, otherwise 8j — ir. Fig. [21 
shows a graphical representation of such a sequential at- 
tack for the case M = 5 and M m i n — 3. In this example, 
moreover, we assume that Eve obtains m = 4 consecutive 
successful results within a block. 

Next, we obtain an expression for the Gain of a se- 
quential attack, i.e., the probability that Bob obtains 
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a click per signal state sent by Alice, as a function of 
the parameters M, M min , q, the probability p succ of ob- 
taining a successful result, and the mean photon- number 
M/3 = \P\ 2 °f the coherent states sent by Eve. Afterwards, 
we study the two sequential attacks introduced above in 
more detail. The objective is to find an expression for 
the quantum bit error rate (QBER) introduced by Eve, 
and for the resulting double click rate at Bob's side in 
each of these two attacks. 



A. Gain of a sequential attack 

The Gain of a sequential attack is defined as N c u c k a /N, 
where N c Hcks represents the average total number of 
clicks obtained by Bob, and N is the total number of 
signal states sent by Alice. In this definition, we con- 
sider that double clicks contribute to N c u c ks like sin- 
gle clicks. The parameter N c i ic ^ s can be expressed as 
N cll cks = (N/M)N% cks , with N™ c ks denoting the aver- 
age total number of clicks per block of length M at Bob's 
side. With this notation, the Gain of a sequential attack, 
that we shall denote as G, can then be written as 



G = ±-N M 



M 



clicks ■ 



(i) 



Next, we obtain an expression for N¥ icks . We shall dis- 
tinguish several cases, depending on the number m of co- 
herent states \Pe lSl ), \f3e l<>2 ), |/3e l9m ) that Eve sends 
to Bob inside a given block and the position of these co- 
herent states in the block 30] . These cases are illustrated 
in Fig. |3| where we also include the a priori probabilities 
to be in each of these scenarios. Note, however, that the 
average total number of clicks in each of these cases will 
also depend on whether the last signal state of a previous 
block is actually a coherent state or not. To include this 
boundary effect between blocks in our analysis, we shall 
always distinguish two possible alternatives for each case 
included in Fig. |3 depending on the identity of the last 
signal state contained in the previous block. The prob- 
ability of this last signal being a coherent state, that we 
shall denote as p, is calculated in Appendix and it is 
given by 



P = [Psucc + (1 - Psucc)q\P, 



M mir , 
succ 



(2) 



Similarly, 1 — p represents the probability that the last 
signal in a block is a vacuum state. Fig. 0] illustrates 
these two alternatives for the case where Eve sends to 
Bob a block of signals containing M coherent states. 

Let us now analyze the different scenarios included in 
Fig. |3 in more detail. When Eve sends to Bob a block of 
signals containing M coherent states (Case A in Fig. |3J) 
then: If the last signal state of the previous block is a 
coherent state, then it turns out that the average total 
number of clicks obtained by Bob is given by Ms, where 
the parameter s has the form 
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FIG. 3: Possible blocks of M signals that Eve sends to Bob 
together with their a priori probabilities. Case A: The block 
contains M coherent states. Case B: The first m G (M m i n , M) 
signals of the block are coherent states, while the last M — m 
signals are vacuum states. Case C: The block contains first 
M — m vacuum states followed by m £ (M m i„,M) coherent 
states. Case D: The block has m £ (M m i n , M) coherent states 
and, at least, the first and the last signal of the block are 
vacuum states. Case E: The first M m i„ signals of the block are 
coherent states, while the last M — M m in signals are vacuum 
states. Case F: The block contains first M — M m in vacuum 
states together with M m i n coherent states. Case G: The block 
has M m i n coherent states and, at least, the first and the last 
signal of the block are vacuum states. Case H: The block 
contains only vacuum states. The a priori probability of this 
last scenario is given by 1 — ^2 t Pi, with pi representing the a 
priori probabilities of each of the previous cases. 
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FIG. 4: Eve sends to Bob a block of signals containing M 
coherent states (Block n in the Figure). Case A: with proba- 
bility p, where p is given by Eq. @, the last signal state of the 
previous block is a coherent state. Case B: with probability 
1 — p the last signal state of the previous block is a vacuum 
state. 



s = 1 -exp(-(j.p), (3) 
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with fip being again the mean photon-number of the co- 
herent states \/3e j ) sent by Eve. Otherwise, the average 
total number of clicks at Bob's side can be written as 
t + (M — l)s, where the parameter t is given by 

t = l-«p(-£fi). (4) 

The analysis of the remaining cases is similar. If the first 
rn e (M min ,M) signal states of the block are coherent 
states, while the last M — m signals are vacuum states 
(Case B in Fig. |3J) then: If the last state of the previ- 
ous block is a coherent state, the average total number 
of clicks obtained by Bob is given by t + ms. Other- 
wise, the average total number of clicks at Bob's side 
can be written as 2t + (m — l)s. Eve can as well send 
to Bob a block containing first M — m vacuum states 
followed by m £ (M m i n , M) coherent states (Case C in 
Fig. EJ. In this situation, if the last state of the previ- 
ous block is a coherent state, the average total number 
of clicks obtained by Bob is given by 2t + (to — l)s. Oth- 
erwise, the average total number of clicks has the form 
t + (m— l)s. When Eve sends to Bob a block of signals 



where, at least, the first and the last signals of the block 
are vacuum states (Case D in Fig. |3J) then: If the last 
state of the previous block is a coherent state, the aver- 
age total number of clicks obtained by Bob is given by 
M + (m — l)s. Otherwise, the average total number of 
clicks has the form 2t + (to — l)s. The cases E, F, and G, 
in Fig. are completely analogous to the the cases B, C, 
and D, respectively. The only difference arises in the a 
priori probabilities to be in each of these scenarios. Now, 
these a priori probabilities need to be multiplied by the 
factor q introduced in Sec. IIIII i.e., by the probability 
that Eve actually decides to send M m in coherent states 
in the block. Finally, when the block contains only vac- 
uum states (Case H in Fig.[3J then: If the last state of the 
previous block is a coherent state the average total num- 
ber of clicks obtained by Bob is given by t. Otherwise, 
the average total number of clicks is zero. 

After adding all these terms, together with their a pri- 
ori probabilities, we obtain that the average total number 
of clicks per block of length M at Bob's side in a sequen- 
tial attack can be expressed as 



N, 



M 

clicks 



P t 



r SUC 



E 



1 (1 - PsuccM 



M„ 



l <m<M 



+ (M - m - 1)(1 - p SU cc)w Tt 



(5) 



where S n 



is equal to one if to 



and it is 



zero otherwise, and the parameters um, v m , and w m , are 
given by 



u M = (l-2p)t+(M-l+p)s, 
u m = (3-2p)t+(2m+p-2)s, 
w m = 2t+(m— l)s. 



(G) 



IV. 



SEQUENTIAL UNAMBIGUOUS STATE 
DISCRIMINATION ATTACK 



As already mentioned in the previous section, in this 
attack Eve performs unambiguous state discrimination 
(USD) [Hill] of Alice's signal states. Whenever Eve 
identifies without error a signal state sent by Alice then 
she considers this result as successful. If the identification 
process does not succeed, then she considers it a failure. 
The probability of obtaining a successful result per signal 
state sent by Alice has the form 221 



Ps 



= 1 - \{a\ - a) | = 1 - exp (-2^ a ), 



(7) 



where fi a is the mean photon-number of the signal states 
sent by Alice, i.e., /i Q = \a\ 2 . 

Next, we obtain an expression for the quantum bit er- 
ror rate (QBER) introduced by Eve with this attack, and 
also for the resulting double click rate at Bob's side. 



A. Quantum bit error rate 

The QBER is defined as N errors /N c u c k s , where N errors 
represents the average total number of errors obtained 
by Bob, and N c n c k s is again the average total number 
of clicks at Bob's side. The parameter N errors can be 
expressed as N errors — (N/M)N^ rors , with N^ rors de- 
noting the average total number of errors per block of 
length M. With this notation, the QBER of a sequential 
attack, that we shall denote as Q, can then be expressed 
as 



1 N. 



A I 



M G 



(8) 



Next, we obtain an expression for N^ rors . We 
shall distinguish the same cases as in the previous sec- 
tion, depending on the number m of coherent states 
\(3e iei ), \/3e i92 ), |/3e iSm ) inside a block and their po- 
sition in the block. 

Whenever the previous signal of a coherent state in- 
side the block is a coherent state, then no errors oc- 
cur since both signals have the proper relative phase 
between them. On the contrary, if the previous signal 
of a coherent state is a vacuum state or if the previ- 
ous signal of a vacuum state is a coherent state then 
it turns out that an error can happen with probability 
exp (-/*/j/4)[l - exp (-p/s/4)] + [1 - exp (- M/3 /4)] 2 /2 = 
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t/2, where the parameter t is given by Eq. J2J. The error 
term [1 — exp (— ^ / g/4)] 2 /2 that appears in the previous 
expression arises from double clicks at Bob's side. Here, 
we consider that double click events are not discarded by 
Bob, but they contribute to the sifted key. Every time 
Bob obtains a double click, he just decides randomly the 
bit value [3l|. 

Let us begin with Case A in Fig. [3J According to the 
previous paragraph, if the last signal state of the previous 
block is a coherent state, then the average total number of 
errors obtained by Bob is zero. Otherwise, it is given by 
t/2. When the first m £ (M m j„,M) signal states of the 
block are coherent states (Case B in Fig. |3J) and the last 
state of the previous block is also a coherent state, then 
the average total number of errors obtained by Bob is 
given by t/2. Otherwise, the average total number of er- 
rors is t. Similarly, if Eve sends to Bob a block containing 
first M — m vacuum states followed by m S (M m i n , M) 
coherent states (Case C in Fig. |3l and the last signal of 
the previous block is a coherent state, then the average 
total number of errors is given by t. Otherwise, the av- 
erage total number of errors has the form t/2. Eve can 
also send a block of signals where, at least, the first and 



the last signals of the block are vacuum states (Case D 
in Fig. Then, if the last state of the previous block is 
a coherent state, the average total number of errors ob- 
tained by Bob is given by 3£/2. Otherwise, the average 
total number of errors is t. Like in the previous section, 
the results for the cases E, F, and G, in Fig.[3|can be ob- 
tained directly from the cases B, C, and D, respectively. 
One only needs to multiply the a priori probabilities to 
be in each of these last three scenarios by the factor q. 
Finally, if the block contains only vacuum states (Case 
H in Fig. |3J and the last state of the previous block is a 
coherent state, then the average total number of errors 
is given by t/2. Otherwise, the average total number of 
errors is zero. 

After adding all the terms together, and taking into 
account the a priori probabilities of each case, we ob- 
tain that the average total number of errors per block of 
length M in a sequential USD attack has the following 
form 

N M = tS (9) 

errors y^J 

where the parameter S is given by 



q = H + n M 

W 2 r SUCC 



E < 

in <m<M 



'(1 -PsuccWs ■tie 



P) +(M - m - 1)(1 -Psucc) 



(10) 



B. Double click rate 

The double click rate at Bob's side, that we shall 
denote as D c , is typically defined as D c = Nd c /N, 
where No c refers to the average total number of dou- 
ble clicks obtained by Bob, and N is again the total 
number of signal states sent by Alice. Nd c is given by 
N Dc = (N/M)N^ c , with denoting the average total 
number of double clicks per block sent by Eve at Bob's 
side. The D c can be written as 

J>c = ^<. (ID 

In order to obtain an expression for , we can again 
distinguish the same different cases included in Fig. [3] 
Double clicks can only occur when the previous signal 
of a coherent state is a vacuum state or when the pre- 
vious signal of a vacuum state is a coherent state. The 
probability to obtain a double click in each of these two 
scenarios, that we shall denote as d, is given by 

d=[l-exp(-^)] 2 . (12) 

Otherwise, the probability to have a double click is al- 
ways zero. The analysis is then completely equivalent to 



the one included in Sec. II V Al one only needs to substi- 
tute the parameter t/2 by d. We obtain, therefore, that 
the average total number of double clicks per block sent 
by Eve in a sequential USD attack can be written as 

Np c = 2dS, (13) 

with S given by Eq. l(TU|> . 

C. Evaluation 

We have seen above that a sequential USD attack can 
be parameterized by the block size M, the minimum 
number M m .;„ of consecutive successful results within a 
block that Eve needs to obtain in order to send Bob a 
new train of coherent states, the mean photon-number 
(ip of these coherent states sent by Eve, and the value of 
the probability q, i.e., the probability that Eve actually 
decides to send M m i n coherent states in a block instead 
of only vacuum states. 

Fig. [3] shows a graphical representation of the Gain 
versus the QBER in this attack for different values of the 
maximum tolerable double click rate at Bob's side. In 
this example we consider that the mean photon number 
of Alice's signal states is given by /x a = 0.16. Moreover, 
we fix the value of M m i n as M m i n — [M/2 + lj and, 
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FIG. 5: Gain versus QBER in a sequential USD attack for 
different values of the maximum tolerable double click rate 
at Bob's side: D c < 1CT 8 (solid), D c < 1CT 10 (dashed), and 
D c < KT 12 (dotted). The mean photon number of Alice's sig- 
nal states is fi a = 0.16. The triangle represents experimental 
data from Ref. 



FIG. 6: Gain versus QBER in a sequential USD attack. The 
solid line corresponds to a maximum tolerable double click 
rate at Bob's side of D c < 10~ 8 . The dashed line represents 
the case where Alice and Bob do not monitor separately the 
double click rate obtained by Bob. The mean photon number 
of Alice's signal states is fi a = 0.16. The triangle represents 
experimental data from Ref. [l6T |. 



for each given values of the parameters M, q <E [0,1], 
and the maximum tolerable double click rate obtained 
by Bob, we perform a numerical optimization to find the 
optimal mean photon number up for each case, i.e., the 
one that provides a lower QBER for a given value of 
the Gain. Fig. El also includes experimental data from 
Ref. [lfij . According to these results we find that, unless 
Alice and Bob reject a double click rate as low as 10~ 8 , 
the DPS QKD experiment reported in Ref. ^(| would be 
insecure against a sequential USD attack. More precisely, 
our analysis suggest that in this kind of QKD protocols is 
not enough for Alice and Bob to include the effect of the 
double clicks obtained by Bob in the QBER [3l|], but it 
might be very useful for the legitimate users to monitor 
also the double click rate to guarantee security against a 
sequential attack. The authors of Ref. already no- 
ticed in Ref. p"?| that their experiment is not covered by 
the existing initial security analysis provided in Ref. [15| . 
Our result is strong as it also shows that when the double 
click rate at Bob's side is above 10 -8 no improved classi- 
cal communication protocol or improved security analysis 
might allow the data of Ref. Jfij to be turned into secret 
key. 

Fig. shows a graphical representation for the case 
where Alice and Bob do not monitor separately the 
double click rate and Eve can optimize the mean pho- 
ton number fip for each given values of M, M m i n = 
[Af/2 + lj , and the parameter q, without any restriction 
on the maximum tolerable double click rate at Bob's side. 

A similar representation is plotted in Fig. {7\ but now 
for the case /i a = 0.2 and for different values of the max- 
imum double click rate at Bob's side. In this figure we 
also include data from a recent experiment reported in 
Ref. [13, where the QBER was reduced to a value of only 
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FIG. 7: Gain versus QBER in a sequential USD attack for 
different values of the maximum tolerable double click rate at 
Bob's side: D c < 10" 10 (solid), D c < 10~ 12 (dashed), and 
D c < 10" 14 (dotted). The mean photon number of Alice's 
signal states is fi a = 0.2. The triangle represents experimental 
data from Ref. (l7|. 



3.4%. The scenario where Alice and Bob do not monitor 
separately the double click rate obtained by Bob is illus- 
trated in Fig. EI In both cases, our results are consistent 
with the possibility to create secret keys. 

According to the figures presented in this section, 
whenever Eve tries to increase the Gain of this attack 
by reducing, for instance, the size M of her blocks, 
she also increases the resulting QBER obtained by Bob. 
The maximum value of the Gain that Eve can achieve, 
however, is actually limited by the probability p succ = 
1 — exp (— 2/x Q ) of obtaining a successful result when 
distinguishing unambiguously the states |±a). Since, 
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FIG. 8: Gain versus QBER in a sequential USD attack. The 
solid line corresponds to a maximum tolerable double click 
rate at Bob's side of D c < 10~ 10 . The dashed line represents 
the case where Alice and Bob do not monitor separately the 
double click rate obtained by Bob. The mean photon number 
of Alice's signal states is /x a = 0.2. The triangle represents 
experimental data from Ref. [r?|. 
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FIG. 9: Gain versus QBER for a sequential USD attack (solid) 
and for a sequential attack where Eve employs the same de- 
tection device like Bob (dashed). The maximum tolerable 
double click rate at Bob's side is D c < 10~ 8 and the mean 
photon number of Alice's signal states is /i Q = 0.16. The 
triangle represents experimental data from Ref. flrjl . 



by definition, [M/2 + lj < M m i n < M, the minimum 
value of a valid block size M is given by M = 3. This 
means, in particular, that in order to maximize the Gain 
of a sequential USD attack the best choice for Eve is 
to select M = 3 and M m i n — 2. Moreover, we can as- 
sume that Eve always sends to Bob M m i n coherent states 
\(3e iei ),\[3e l<>2 ),..., \(3e l()M ^) when she obtains M mm 
successful results (i.e., q = 1), and that these coherent 
states have a really high mean photon number such as 
she increases Bob's probability of obtaining a click (i.e., 
> 1 and, therefore, s « 1, t « 1, and d w 1). Using 
these values in Eq. and Eq. (0 we obtain that the 
maximum value of the Gain in this attack is given by 

succ Psucc)Psucc ("^^") 

In this case the QBER, and the double click rate at Bob's 
side are, respectively, given by Q w (2-p succ -p 2 succ )/ (6- 
2psucc — Psucc) an d D c « 2(2 — p succ — P succ )p succ /3. 

On the contrary, the minimum value of the Gain occurs 
when Eve treats the total number of signals N sent by 
Alice as a single block, i.e., M — N, and she further im- 
poses M m i n = M — 1, q = 0, and s « 1. In this case, the 
minimum Gain is given by p^ ucc , and the QBER and dou- 
ble click rate at Bob's side are both zero. This scenario 
corresponds to the situation where Eve only sends N co- 
herent states |/3e iei ), \(3e i92 ), \(3e i9N ) to Bob when she 
succeeds discriminating without error all the signal states 
sent by Alice. 

Finally, let us mention that, instead of using an USD 
measurement on each signal state sent by Alice, Eve 
could as well employ the same detection device like Bob. 
This sequential attack was very briefly introduced in 
Ref. [H|. In this successful result is associated 

with obtaining a click in Eve's apparatus, while a failure 



corresponds to the absence of a click. The train of coher- 
ent states \/3e lBl ), \/3e l62 ), \/3e l6m ) that Eve sends to 
Bob is now selected such as the relative phase between 
consecutive signals agree with Eve's measurement results. 
If we assume that Eve does not analyze each block of 
data independently, but she also includes a proper rela- 
tive phase between blocks when the last signal of a pre- 
vious block and the first signal of the following one are 
coherent states, then the results included in this section 
also apply to that case. Otherwise, the QBER in such 
kind of attack will be always higher than in a sequential 
USD attack. However, since Alice's signal states are typ- 
ically coherent pulses with small average photon number 
(i.e., \a\ 2 <§; 1), Eve observes click events only occasion- 
ally. In particular, when she uses the same detection 
apparatus like Bob then the probability of obtaining a 
successful result will be always smaller than the one of 
a sequential USD attack. More precisely, this success 
probability has now the form p succ = 1 — exp (—//«), and 
is smaller than the success probability given by Eq. J7J. 
Fig.OHshows a graphical representation of the Gain versus 
the QBER for a sequential USD attack together with a 
sequential attack where Eve employs the same detection 
apparatus like Bob. In this example the maximum toler- 
able double click rate at Bob's side is given by D c < 10~ 8 
and the mean photon number of Alice's signal states is 
fi a = 0.16. Moreover, we fix again the value of M m i n 
as M m i n = [M/2 + lj and, for each given values of the 
parameters M and q € [0,1], we perform a numerical 
optimization to find the optimal fj.^ for each case like be- 
fore. From the results included in Fig. we see that a 
sequential USD attack can provide tighter upper bounds 
on the performance of DPS QKD schemes than a sequen- 
tial attack with Eve employing the same detection device 
like Bob. 
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SEQUENTIAL MINIMUM ERROR 
DISCRIMINATION ATTACK 



In this eavesdropping strategy Eve performs first a fil- 
tering operation on each signal state sent by Alice with 
the intention to make them, with some finite probability, 
more "distinguishable" . Afterwards, Eve measures out 
each successful filtered state with a measurement device 
that gives her the minimum value of the error probability 
when identifying the states 0, H3 ■ Her goal is to try to 
determine whether the filtered states originate from \a) 
or from | — a) . 

The coherent states sent by Alice can be expressed in 
some orthogonal basis {|0), |1)} as follows 



±a) =a|0)±6|l) 



(15) 



where we assume, without of generality, that the coeffi- 
cients a and b are given by 



a = \ o t 1 + exp ( _2 ^«)] 



b = \j 2 [1 - ex P (-2/V)] 



(16) 

(17) 
(18) 

1, and a > b 



that is, they satisfy, a G M, b G M, a + 1 
when p a 7^ 0. 

We shall consider that Eve uses a filtering operation 
defined by the following two Kraus operators 32]: 



A succ {\) = A|0)(0| + 

Af a u(\) = vi-y 



ll)<ll 



(19) 
(20) 



where the coefficient A satisfies A G [b/a, 1]. This param- 
eter allows Eve to increase the probability of obtaining a 
successful result and, therefore, she can increase the Gain 
of her attack. On the other hand, Eve can introduce also 
more errors at Bob's side. 

Suppose that the filtering operation receives as in- 
put the state | ± a) . The probability of getting a suc- 
cessful result can be calculated as p succ = p^ ucc — 
Tr[| ±a)(±a\ Al ucc (X)A succ (X)]. This quantity is given 
by 



Eve follows the approach of MED. That is, she em- 
ploys a measurement strategy that guesses the iden- 
tity of the signals | ± a SU cc) with the minimum prob- 
ability of making an error. For the case of two pure 
states with equal a priori probabilities, like it is the 
case that we have here, the optimal value of the error 
probability, that we shall denote as y e r r, is given by 
Perr = [l~ V 1 = I (-cWc|(Wc) | 2 ]/2 0. From Eq. ^ 
we obtain, therefore, 



Pe 



1 (oA - bf 
2a 2 X 2 +b 2 ' 



(23) 



r SUCC 



2 A 2 + b 2 



(21) 



The von Neumann measurement which can be used to 
attain this error probability is given by the optimum de- 
tector states |±) = l/\/2(|0) ± |1)). 

Note that the sequential USD attack introduced in 
Sec. lIVI can then be seen as a special case of this sequen- 
tial MED attack. When A = b/a, the success probability 
in a sequential MED attack is given by p^ ucc = 2b 2 = 
1 — exp (— 2fj, a ), which coincides with the success proba- 
bility given by Eq. Q. Moreover, in this case the error 
probability p err is zero. 

Next, we obtain an expression for the QBER intro- 
duced by Eve with this attack, and also for the resulting 
double click rate at Bob's side. 



A. Quantum bit error rate 

From Eq. JSJl we learn that in order to obtain an ex- 
pression for the QBER in a sequential attack we only 
need to find the average total number of errors N^ rors 
per block of length M. 

Now, however, the analysis is slightly different from 
that considered in Sec. lIV Al since two consecutive coher- 
ent states in a block can also produce errors. This arises 
from the fact that sometimes Eve does not identify cor- 
rectly the signal states | ± a) sent by Alice. In particular, 
whenever the previous signal of a coherent state inside a 
block is also a coherent state, then an error can occur 
with probability [p err (l — p err ) +p err (l — p err )]s, where 
p err is given by Eq. (|23|l and s is given by Eq. © . This is 
the probability that only one of the two coherent states 
is wrongly identify by Eve and Bob detects the error by 
means of a click in his apparatus. We shall denote this 
error probability as p er r- Using Eq. I|23|) . we can write 

P&VT 



If the filtering operation succeeded, the resulting normal- 
ized filtered state, that we shall denote as | ± ct succ ), can 
be calculated as | ± a succ ) = (l/\/p$ ucc ) A SUCC (A)| ± a). 
We obtain 



1 



VP: 



A 

SUCC 



(Ao|0)±6|l». 



(22) 



As already mentioned previously, in order to decide 
which signal state was used by Alice, we consider that 



1 fa 2 X 



Pe 



1 \2 



2 V a 2 A 2 + b 2 



(24) 



If the previous signal of a coherent state is a vacuum 
state or if the previous signal of a vacuum state is a co- 
herent state then the error probability is the same as in 
Sec. lIV Al i.e., it has the form t/2 with t given by Eq. Q. 

We can now address the different cases contained in 
Fig. El like in the previous sections and obtain an expres- 



sion for N. 



M 



as a function of these two error probabil- 
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ities. The analysis is included in Appendix [5] We find that N^ rors can be written as 
I 



N. 



M 



pt 

2 



M min <m<M 



(1 Psucc)Psuc> 



+ (M - m - 1)(1 - p S ucc)w r , 



(25) 



where the parameters um, v m , and u> m , are given by 

UM = ^ h ^ ~ 1 + PiPerr, 

«m = ^ ^ l + {2m + p- 2)p err , 

W m = t+(m-l)p err , (26) 

and with p given by Eq. J3J • 

B. Double click rate 

Like in the case of a sequential USD attack, also in this 
attack double clicks can happen only when the previous 
signal of a coherent state is a vacuum state or when the 
previous signal of a vacuum state is a coherent state. The 
probability to obtain a double click in each of these two 
scenarios does not depend on the value of the phase 6j of 
the coherent state \(3e l0j ) involved, but it depends only 
on the mean photon- number up. This means that the 
analysis included in Sec. liVBl also applies here, and the 
average total number of double clicks per block sent by 
Eve in a sequential MED attack is also given by Eq. (|13f) . 
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FIG. 10: Gain versus QBER in a sequential MED attack for a 
fix value of the maximum tolerable double click rate at Bob's 
side (D c < 10~ 8 ), and for different values of the parameter 
A: Ai = b/a (solid), A2 = b/a + (1 — b/a)/5 (dashed), A3 = 
b/a + 2(1 -b/a)/5 (dotted), A 4 = b/a + 3(1 - b/a)/5 (dashed- 
dotted), A 5 = b/a + 4(1 - b/a)/5 (thick solid), and A 6 = 1 
(thick dashed). The mean photon number of Alice's signal 
states is fi a = 0.16. The triangle represents experimental 
data from Ref. (l6| . 



C. Evaluation 

In Fig. EH we plot the Gain versus the QBER in a 
sequential MED attack for a fix value of the maximum 
tolerable double click rate at Bob's side (D c < 10~ 8 ) and 
for different values of the parameter A. Like in Sec. lIV 01 
we fix the value of M m i n as M m i n = \_M/2 + lj, and 
we perform a numerical optimization to find the optimal 
mean photon number fj,p for each given values of the pa- 
rameters M, q, and A. Moreover, in this example, we 
consider that the mean photon number of Alice's signal 
states is given by /j, a — 0.16 and we also include the 
experimental data obtained in Ref. [T^ |. 

A similar graphical representation is included in 
Fig. ^2 but now for the case where Alice and Bob do 
not monitor separately the double click rate and Eve can 
optimize the mean photon number p,p for each given val- 
ues of M, M min = [M/2 + lj , q, and the parameter A, 
without any restriction on the maximum tolerable double 
click rate at Bob's side. 

While in a sequential USD attack the maximum value 
of the Gain is given by Eq. i|14fl . in a sequential MED 



attack Eve can always increase the value of the Gain 
at the expense of also increasing the resulting QBER at 
Bob's side, just by incrementing the parameter A. In 
particular, in the limit case of A = 1, i.e., the filtering 
operation is just the identity operation, we have that p = 
1 and Psucc = 1- In this situation, the Gain, the QBER, 
and the double clock rate at Bob's side are, respectively, 
given by G = 1 — exp(— /xg), Q = cxp(— 4/i Q )/2, and 
D c = 0. That is, by selecting a proper mean photon 
number jip Eve can always access any high value of the 
Gain. 



VI. CONCLUSION 

In this paper we have quantitatively analyzed limita- 
tions on the performance of differential-phase-shift (DPS) 
quantum key distribution (QKD) protocols based on 
weak coherent pulses. For that, we have investigated 
simple eavesdropping strategies based on sequential at- 
tacks: Eve measures out every coherent state emitted by 
Alice and prepares new signal states, depending on the 
results obtained, that are given to Bob. Whenever Eve 
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FIG. 11: Gain versus QBER in a sequential MED attack for 
the case where Alice and Bob do not monitor separately the 
double click rate obtained by Bob, and for different values of 
the parameter A: Ai = b/a (solid), A2 = b/a + (1 — b/a)/5 
(dashed), A 3 = b/a + 2(1 - b/a)/5 (dotted), A 4 = 6/a + 3(l- 
b/a)/5 (dashed-dotted), A 5 = b/a + 4(1 - b/a)/5 (thick solid), 
and A6 = 1 (thick dashed). The mean photon number of 
Alice's signal states is [i a = 0.16. The triangle represents 
experimental data from Ref. [T3 |. 



pulses with small average photon number, the probability 
of obtaining a successful result in this scenario is always 
smaller than the one of a sequential USD attack. There- 
fore, a sequential USD attack can provide tighter upper 
bounds on the performance of DPS QKD protocols than 
those derived from a sequential attack where Eve uses 
the same measurement apparatus like Bob. 

While in the standard Bennett-Brassard 1984 (BB84) 
QKD protocol with phase randomized weak coherent 
state sources it generally suffices that the legitimate users 
monitor the error rate and gain of the scheme to guaran- 
tee unconditional security, our analysis suggest that, in 
DPS QKD, it might be very useful for the legitimate users 
to monitor also the double click rate or the correlations of 
detection probabilities between adjacent time-slots. This 
fact could substantially increase Alice and Bob's ability 
in defeating sequential attacks. Therefore, it might be 
advantageous for a security proof of DPS QKD to include 
also Alice and Bob's knowledge of double click rates and 
correlations of detection events. Such a security proof 
would be rather different from existing security proofs of 
the standard BB84 protocol which often involves random 
permutation and random sampling arguments. 



obtains a predetermined number of consecutive success- 
ful measurement outcomes, then she prepares a train of 
new coherent pulses that is forwarded to Bob. Other- 
wise, Eve sends vacuum signals to Bob to avoid errors. 
Sequential attacks transform the original quantum chan- 
nel between Alice and Bob into an entanglement breaking 
channel and, therefore, they do not allow the distribution 
of a secret key. 

Specifically, we have considered two possible sequen- 
tial attacks. In the first one, Eve realizes unambiguous 
state discrimination (USD) of Alice's signal states. When 
Eve identifies unambiguously a signal state sent by Alice, 
then she considers this result as successful. Otherwise, 
she considers it a failure. In the second attack, Eve per- 
forms first a filtering operation on each signal emitted 
by Alice and, afterwards, she measures out each success- 
ful filtered state following the approach of minimum error 
discrimination, i.e., she guesses the identity of the filtered 
state with the minimum probability of making an error. 
As a result, we obtained upper bounds on the maximal 
distance achievable by differential-phase-shift quantum 
key distribution schemes as a function of the error rate 
in the sifted key, the double click rate at Bob's side, and 
the mean photon-number of the signals sent by Alice. 
It states that no key distillation protocol can provide a 
secret key from the correlations established by the users. 

Instead of using an USD measurement on each signal 
state sent by Alice, like in the first eavesdropping strat- 
egy that we considered, Eve could as well employ the 
same detection device like Bob [l5|. A successful result 
is now associated with obtaining a click in Eve's appara- 
tus, while a failure corresponds to the absence of a click. 
However, since Alice's signal states are typically coherent 
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APPENDIX A: PROBABILITY p 

In this Appendix we obtain an expression for the prob- 
ability p that the last signal in a given block is a coherent 
state |/3e 4 ^). 

Let p m be the probability of Eve sending to Bob m 
consecutive coherent states within a block of length M 
such that the last signal of the block is a coherent state. 
This probability is given by 



Pn 





(1 — Psucc)Psucc 
M 

1 StICC 



if m < M„ 
if m = Mr, 



if M„ 



<m < M 



(Al) 



if m = M. 

For each given block of signals that Eve sends to Bob we 
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have, therefore, that p can be written as 

M 

p= ^2 Pm= \- Psucc + t 1 ~ Psu C c)q]pf^c n ■ ( A2 ) 

m=M mirh 

Similarly, 1 — p represents the probability that the last 
signal in a block is a vacuum state. 

APPENDIX B: N^ rora IN A SEQUENTIAL 
MINIMUM ERROR DISCRIMINATION ATTACK 

In this Appendix we obtain an expression for the av- 
erage total number of errors N^ rors per block of length 
M sent by Eve in a sequential MED attack. 

We shall distinguish the different cases included in 
Fig. [31 i.e., as a function of the number m of coherent 
states inside a block and their position in the block. 

Let us begin with Case A in Fig. [31 According to 
Sec. IV AI whenever the last signal state of the previous 
block is a coherent state then the average total number of 
errors obtained by Bob is given by Mp err . Otherwise, it 
is given by [M — l)p err + t/2. If the first m £ (M m in, M) 
signal states of the block are coherent states (Case B in 
Fig. [3Jl and the last state of the previous block is also a 
coherent state, then the average total number of errors 
obtained by Bob is given mp err + t/2. Otherwise, the 
average total number of errors is (to— l)p err +t. Similarly, 



if Eve sends to Bob a block containing first M—m vacuum 
states followed by m € (M min , M) coherent states (Case 
C in Fig. 01 and the last signal of the previous block is 
a coherent state, then the average total number of errors 
is given by (to — l)p er r + t. Otherwise, the average total 
number of errors has the form (to — l)p err + t/2. Eve can 
also send to Bob a block of signals where, at least, the 
first and the last signals of the block are vacuum states 
(Case D in Fig.|3J). Then, if the last state of the previous 
block is a coherent state, the average total number of 
errors obtained by Bob is given by (to — \)p err + 3t/2. 
Otherwise, the average total number of errors is (to — 

l)Perr ~1~ ^* 

The results for the cases E, F, and G, in Fig. [31 can 
be obtained directly from the cases B, C, and D, respec- 
tively. One only needs to multiply the a priori proba- 
bilities to be in each of these last three scenarios by the 
factor q. 

Finally, whenever the block that Eve sends to Bob con- 
tains only vacuum states (Case H in Fig. [31 and the last 
signal of the previous block is a coherent state, then the 
average total number of errors is given by t/2. Otherwise, 
the average total number of clicks is zero. 

After including all the a priori probabilities to be in 
each of the different cases discussed above, we obtain that 
the average total number of errors per block of length M 
in a sequential MED attack is given by Eq. (|25|l . 
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